GitHub Advisoryadvisory · Maven

GHSA-m9gh-789g-q5pv Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

MEDIUM Published 2025-12-15 Modified 2026-09-25 Official page ↗
Aliases
CVE-2025-37731
Ecosystem
Maven
Packages
org.elasticsearch.plugin:x-pack-security, org.elasticsearch.plugin:x-pack-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-295
Reviewed
2025-12-16

Affected packages

• Maven org.elasticsearch.plugin:x-pack-security: >= 7.0.0-alpha1, < 8.19.8 → fixed in 8.19.8 • Maven org.elasticsearch.plugin:x-pack-security: >= 9.0.0-beta1, < 9.1.8 → fixed in 9.1.8 • Maven org.elasticsearch.plugin:x-pack-security: >= 9.2.0, < 9.2.2 → fixed in 9.2.2 • Maven org.elasticsearch.plugin:x-pack-core: >= 7.0.0-alpha1, < 8.19.8 → fixed in 8.19.8 • Maven org.elasticsearch.plugin:x-pack-core: >= 9.0.0-beta1, < 9.1.8 → fixed in 9.1.8 • Maven org.elasticsearch.plugin:x-pack-core: >= 9.2.0, < 9.2.2 → fixed in 9.2.2

Description

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

Related

Alias · CVE (1)

  • CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-295 Improper Certificate Validation weakness

References